This is the lowdown on CVE-2026-109618 and CVE-2026-109619, in addition to what web site homeowners and IT groups ought to do to remain secure – all in a little bit greater than two minutes
26 Oct 2026
Final week, particulars emerged a couple of pair of essential vulnerabilities in PHP, a server-side scripting language generally utilized in internet growth. The information prompted safety advisories from authorities businesses and despatched web site homeowners scrambling to use the patches, with some websites even going offline as a precaution. It is because on an unpatched server, an attacker can exploit the vulnerabilities to run their very own code with out logging in. As three out of 4 web sites globally are estimated to make use of PHP in some capability, its ubiquity helps create an atmosphere ripe for abuse; certainly, preliminary makes an attempt to take advantage of the issues – found by AI and dubbed PHP2Shell – weren’t lengthy in coming.
This is what to learn about CVE-2026-109618 and CVE-2026-109619, in addition to what web site homeowners and IT groups ought to do to remain secure – all in a little bit greater than two minutes.
For detailed mitigation steps and different info, consult with the advisories issued by the PHP Undertaking, CISA, CERT-EU or NCSC.
